Most of the problems that cost a site traffic are invisible to its owner. The site works, loads and sends form messages, yet Google shows it less often than it could and AI assistants have nothing to quote. An SEO audit means looking at the site the way a crawler sees it and turning what it finds into a list of fixes, most important first.
Below is the checklist we work from. Every point has a threshold or a concrete test, so you can tick it off rather than just keep it in mind.
01 Indexing: can Google see the pages at all
- AEvery important page answers with a 200 status and no redirect chains (one redirect at most).
- BInternal links go straight to their final addresses, not through redirects or to 404 pages.
- CThe canonical points to the page itself or its proper equivalent, never to an error page.
- DNoindex is only where it belongs: the cart, logins, thank-you pages.
- Erobots.txt blocks no important sections and points to the sitemap; the sitemap lists only addresses that return 200.
- FImportant pages are at most three clicks from the home page.
02 Titles, descriptions and headings
A page title is the headline of the Google result and the first thing a customer reads. Google's guidance describes when it rewrites titles itself: when they are half empty, vague ("Home"), stuffed with keywords, repeat the same long tail on every page, or say something different from the H1.
- AA title runs to about 60 characters: anything longer gets cut. The brand goes last, and only when it fits.
- BEvery page has its own title and its own meta description (140-160 characters), with no duplicates.
- COne H1 per page, built on the same main keyword as the title.
- DArticles show an author and a publication date, in the data for crawlers too.
03 Speed and Core Web Vitals
Google judges speed by three metrics measured on real Chrome users: LCP (main content shown) within 2.5 s, INP (response to a tap) within 200 ms and CLS (layout shifting) under 0.1. What counts is the 75th percentile of visits, so slower phones and weaker signal too, not your laptop on fibre.
The PageSpeed lab test on a phone shows where the delays come from. The causes we find most often: stylesheets that block the first paint, photos sent to phones at monitor size, fonts fetched only after the styles, and third-party scripts loaded ahead of the content.
04 Structured data
Structured data (JSON-LD) tells Google and AI assistants plainly who you are and what is on the page. Adding it is not enough: Google uses it fully only when it carries the fields that type requires.
- AOrganization: name, address, logo and sameAs with official profiles, such as the Google Business Profile.
- BArticles: author, datePublished, dateModified and an image.
- CA local business: LocalBusiness with address, phone and opening hours.
- DA store: Product with price, availability, and shipping and returns details.
- EEvery block checked in the Google Rich Results Test.
05 AI readiness
ChatGPT, Perplexity and Google AI Overviews quote pages they can read and understand. Most AI crawlers do not run JavaScript, so content that only appears after it runs does not exist for them.
- Arobots.txt does not block GPTBot, OAI-SearchBot, ClaudeBot or PerplexityBot, unless that is a deliberate choice.
- BThe key content and links are in the HTML the server sends, not only after JavaScript.
- CHeadings phrased as the questions customers search for, each followed by a concise answer that can be quoted whole.
- DAn llms.txt file describing the site and listing its most important addresses.
06 Security and e-mail on the domain
This area rarely makes it into SEO audits, which is a pity: no HTTPS lowers trust, an exposed .env file can end a business, and misconfigured e-mail sends offers to spam. We check the security headers (HSTS, Content-Security-Policy, X-Frame-Options), files that should not be public (.env, .git), and the three e-mail DNS records: SPF (at most 10 DNS lookups), DKIM, and DMARC with a working report address.
07 Visibility and competition
Technique is the means; the goal is traffic that sells. That is why an audit should show data from tools like Ahrefs: how many visits the site gets from Google, what they would cost as ads, which keywords are already close to the top, and which keywords the competitors win.
The cheapest traffic to win is usually keywords ranking 4 to 20: Google already considers the page relevant, and it takes little to reach the top three, where most of the clicks go.
08 Free tools worth knowing
- AGoogle Search Console: which pages are indexed, which queries you appear for, and the Core Web Vitals report from real users.
- BPageSpeed Insights: the lab test on phone and desktop, plus Chrome field data when the site has enough traffic.
- CRich Results Test: whether the structured data is valid and which rich results it can produce.
- DAhrefs Webmaster Tools: the links pointing to the site and a basic technical audit for verified domains.
Each of them shows one piece of the picture. An audit puts them together and in order, because a PageSpeed score or a list of links alone does not say what to do first.
09 How often to audit
Always after a big change: a migration, a new template, a new CMS or SEO plugin. An accidental noindex after a release can wipe out traffic within a week, and without a check it is only noticed once sales drop. Beyond that, check the site once a month, or at least once a quarter, and compare with the last result, because it is the changes, not a single snapshot, that show whether the site is heading the right way.
10 Where to start fixing
An audit list can be long, so the order matters more than completeness. Start with what blocks indexing and sales (server errors, noindex on important pages, a broken form), then what gives a lot for little work (titles, keywords just off the podium, photos), and leave larger rebuilds for last. Close every fix with a measurement, so you know what worked.
A good audit ends not with a list of errors but with a plan: what to do this month and how you will know it worked.